github-actions[bot] commented on code in PR #69462:
URL: https://github.com/apache/doris/pull/69462#discussion_r4360080629
##########
fe/fe-core/src/main/java/org/apache/doris/qe/StmtExecutor.java:
##########
@@ -2535,8 +2536,16 @@ private String getStmtForLogging(String stmt) {
}
}
- private String getStmtForLoggingBeforeParse() {
- return getStmtForLoggingBeforeParse(originStmt == null ? null :
originStmt.originStmt);
+ private String getStmtForLogging() {
+ String stmt = originStmt == null ? null : originStmt.originStmt;
+ if (parsedStmt instanceof LogicalPlanAdapter
+ && ((LogicalPlanAdapter) parsedStmt).getLogicalPlan()
instanceof AlterRoutineLoadCommand) {
+ // This command captures only its own masked SQL during the
initial parse.
+ return getStmtForLogging(stmt);
Review Comment:
[P1] Verify statement ownership before trusting captured ALTER SQL
On a follower initially using `NO_BACKSLASH_ESCAPES`, submit this batch for
an existing paused Kafka job:
```sql
SET sql_mode='';
SELECT "prefix\";
ALTER ROUTINE LOAD FOR db.job FROM KAFKA ('property.client.id'="; ALTER
ROUTINE LOAD FOR db.job FROM KAFKA
('property.sasl.password'='synthetic-secret') -- ");
```
Nereids and `SqlUtils.splitMultiStmts` both return three statements, but the
separator always interprets backslash escapes. Nereids's third command has only
`property.client.id`, with the credential ALTER inside its double-quoted value;
the separator's third fragment is that credential ALTER itself, with the
remaining text commented out. `ConnectProcessor` checks only equal counts and
attaches the latter fragment as this command's `OriginStatement`. After SET
clears the mode, `FEOpExecutor` forwards that fragment and the master applies
`sasl.password='synthetic-secret'`.
This new fast path instead logs the original command's frozen capture, and
follower audit uses the same capture. Its isolated ALTER slice has no backslash
and only a nonsensitive client.id key, so both INFO/DEBUG startup output and
the follower audit event retain the actual password. Establish
capture/OriginStatement ownership, or check mode-dependent boundaries over the
full request before slicing and fail closed. Add an
equal-count/different-boundary follower regression. Unlike threads 4356893714
and 4356893706, the current slice is identical under both modes and the
statement counts agree; the boundary change is in the preceding SELECT.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
